@darkhunt-security/endpoint-codex 0.9.20 → 0.9.21

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.20",
+  "version": "0.9.21",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -22403,6 +22403,31 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function attachmentsOf(content, base) {
+  if (!Array.isArray(content))
+    return [];
+  const out = [];
+  for (const [i, block] of content.entries()) {
+    if (!block || typeof block !== "object")
+      continue;
+    const bag = block;
+    if (bag["type"] !== "input_image")
+      continue;
+    const url = str(bag["image_url"]);
+    const comma = url?.startsWith("data:") ? url.indexOf(",") : -1;
+    const header = url !== void 0 && comma > 0 ? url.slice(5, comma).split(";") : [];
+    const mediaType = header[0] || void 0;
+    const bytes = url !== void 0 && header.at(-1) === "base64" ? Math.floor((url.length - comma - 1) * 3 / 4) : void 0;
+    out.push({
+      ...base,
+      uuid: `${base.uuid}:image:${i}`,
+      kind: "attachment",
+      ...bytes !== void 0 ? { bytes } : {},
+      ...mediaType !== void 0 ? { mediaType } : {}
+    });
+  }
+  return out;
+}
 var CODEX_APPROVAL_MODES = {
   never: "auto",
   "on-request": "ask"
@@ -22730,7 +22755,10 @@ var codexTranscript = {
           return [];
         switch (str(payload["role"])) {
           case "user":
-            return [{ ...base, kind: "user_message", text }];
+            return [
+              ...attachmentsOf(payload["content"], base),
+              { ...base, kind: "user_message", text }
+            ];
           case "assistant":
             return [{ ...base, kind: "assistant_message", text }];
           default:

package/dist/bin/forwarder.mjs

@@ -22213,6 +22213,31 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function attachmentsOf(content, base) {
+  if (!Array.isArray(content))
+    return [];
+  const out = [];
+  for (const [i, block] of content.entries()) {
+    if (!block || typeof block !== "object")
+      continue;
+    const bag = block;
+    if (bag["type"] !== "input_image")
+      continue;
+    const url = str(bag["image_url"]);
+    const comma = url?.startsWith("data:") ? url.indexOf(",") : -1;
+    const header = url !== void 0 && comma > 0 ? url.slice(5, comma).split(";") : [];
+    const mediaType = header[0] || void 0;
+    const bytes = url !== void 0 && header.at(-1) === "base64" ? Math.floor((url.length - comma - 1) * 3 / 4) : void 0;
+    out.push({
+      ...base,
+      uuid: `${base.uuid}:image:${i}`,
+      kind: "attachment",
+      ...bytes !== void 0 ? { bytes } : {},
+      ...mediaType !== void 0 ? { mediaType } : {}
+    });
+  }
+  return out;
+}
 var CODEX_APPROVAL_MODES = {
   never: "auto",
   "on-request": "ask"
@@ -22540,7 +22565,10 @@ var codexTranscript = {
           return [];
         switch (str(payload["role"])) {
           case "user":
-            return [{ ...base, kind: "user_message", text }];
+            return [
+              ...attachmentsOf(payload["content"], base),
+              { ...base, kind: "user_message", text }
+            ];
           case "assistant":
             return [{ ...base, kind: "assistant_message", text }];
           default:

package/dist/bin/status.mjs

@@ -1312,6 +1312,31 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function attachmentsOf(content, base) {
+  if (!Array.isArray(content))
+    return [];
+  const out = [];
+  for (const [i, block] of content.entries()) {
+    if (!block || typeof block !== "object")
+      continue;
+    const bag = block;
+    if (bag["type"] !== "input_image")
+      continue;
+    const url = str(bag["image_url"]);
+    const comma = url?.startsWith("data:") ? url.indexOf(",") : -1;
+    const header = url !== void 0 && comma > 0 ? url.slice(5, comma).split(";") : [];
+    const mediaType = header[0] || void 0;
+    const bytes = url !== void 0 && header.at(-1) === "base64" ? Math.floor((url.length - comma - 1) * 3 / 4) : void 0;
+    out.push({
+      ...base,
+      uuid: `${base.uuid}:image:${i}`,
+      kind: "attachment",
+      ...bytes !== void 0 ? { bytes } : {},
+      ...mediaType !== void 0 ? { mediaType } : {}
+    });
+  }
+  return out;
+}
 var CODEX_APPROVAL_MODES = {
   never: "auto",
   "on-request": "ask"
@@ -1639,7 +1664,10 @@ var codexTranscript = {
           return [];
         switch (str(payload["role"])) {
           case "user":
-            return [{ ...base, kind: "user_message", text }];
+            return [
+              ...attachmentsOf(payload["content"], base),
+              { ...base, kind: "user_message", text }
+            ];
           case "assistant":
             return [{ ...base, kind: "assistant_message", text }];
           default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.20",
+  "version": "0.9.21",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {